DACORIS CRIS is a research information management and institutional research intelligence platform offered as part of DACORIS Group. In this Privacy Policy, "DACORIS", "we", "us" and "our" refer to DACORIS Group and the applicable contracting entity identified in the relevant proposal, order form or service agreement.

Contact: info@dacoris.com; +254 732 436 199; based at Strathmore University, Nairobi, Kenya.

This Policy applies when you visit our website, request information or a demonstration, create or use an account, communicate with our support team, attend a DACORIS event, receive marketing communications, or otherwise interact with DACORIS CRIS.

Where an institution provides DACORIS CRIS to its staff, students, researchers or partners, that institution will ordinarily determine why and how institutional data is processed. In that context, the institution is typically the data controller and DACORIS is typically a data processor acting on documented instructions. The applicable agreement may define the roles differently for specific processing activities.

DACORIS CRIS may be configured to hold information that is sensitive or receives special legal protection, including ethics records, research-participant information, health-related research information or other restricted institutional content. Such processing must be specifically authorised, necessary for a defined purpose, supported by an appropriate lawful condition and protected through proportionate access and security controls.

Customers should not upload directly identifiable participant-level or patient-level data unless the agreed service architecture, contract, approvals, notices, consent or other lawful basis, security controls and data-management plan expressly permit that processing.

Depending on the selected hosting environment, support arrangement and integrations, personal data may be processed in a country other than the country in which it was collected. Before such transfers, DACORIS and the institutional customer should document the data locations, relevant recipients and appropriate legal safeguards. These may include adequacy decisions, contractual clauses, consent where legally valid, or another transfer mechanism recognised by applicable law.

We retain personal data for as long as reasonably necessary for the purpose for which it was collected, to provide the service, comply with legal and contractual obligations, resolve disputes, maintain security records and enforce agreements. Institutional content is retained according to the customer agreement and configured retention rules.

At the end of the service, DACORIS will handle return, export, archival or deletion of customer data according to the applicable contract, legal requirements and technical feasibility. Backup copies may remain for a limited period until they are securely overwritten under the backup cycle.

We use technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, loss or destruction. Measures may include access controls, authentication safeguards, encryption, logging, monitoring, backups, secure development, vulnerability management, incident response and staff confidentiality obligations. No system can guarantee absolute security; users and institutions must also protect credentials, devices, integrations and exported data.

Our website and platform may use essential cookies or similar technologies for authentication, session continuity, security, preferences and service operation. We may use optional analytics technologies to understand performance and improve user experience. Where required, optional cookies will be used only after appropriate notice and consent. Browser settings may be used to block or delete cookies, although essential features may then operate incorrectly.

DACORIS CRIS may use automated rules or analytical methods to match funding opportunities to profiles, highlight incomplete requirements, generate risk flags or produce portfolio insights. These functions are intended to support human decision-making. Unless expressly agreed and lawfully configured, DACORIS CRIS should not be used to make solely automated decisions that produce legal or similarly significant effects on an individual.

DACORIS CRIS is primarily intended for institutions, adult researchers, staff and postgraduate users. Where an institution uses the service in a context involving a minor, the institution must ensure that the processing is lawful, appropriately notified, necessary, age-appropriate and supported by required consent or other legal authority.

The service may link to or integrate with third-party websites, databases or tools. Their privacy practices are governed by their own notices and contracts. DACORIS is not responsible for a third party's independent processing, but will apply reasonable diligence and contractual safeguards where that third party acts as a DACORIS subprocessor.

We may update this Policy to reflect changes in law, technology, services or operating practices. We will publish the revised version with an updated effective date and provide additional notice where a change is material or legally required.

For privacy questions, data-subject requests or complaints, contact info@dacoris.com and use the subject line "Privacy Request". You may also call +254 732 436 199. Please provide enough information for us to verify the request and identify the relevant institutional account. You may lodge a complaint with the competent data-protection authority if you believe your personal data has been processed unlawfully.